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Remarks 

Reconsideration of this Application is respectfully requested. 

Upon entry of the foregoing amendment, claims 1-42 are pending in the 
application, with claims 1, 7, 15, 16, 23, 24, 29, and 30 being the independent claims. 
Claims 7, 23, 24, 29 and 30 are sought to be amended. New claims 41 and 42 are sought 
to be added. Applicants reserve the right to prosecute similar or broader claims, with 
respect to the cancelled and amended claims, in the future. These changes are believed 
to introduce no new matter, and their entry is respectfully requested. 

Based on the above amendment and the following remarks, Applicants 
respectfully request that the Examiner reconsider all outstanding rejections and that they 
be withdrawn. 

Statement of Substance of Examiner Interview 

Applicants respectfully thank the Examiner for extending the courtesy of a 
telephone interview on September 17, 2009. In the interview, the Examiner and 
Applicants discussed why the claims distinguished over the applied references. 
Applicants suggested proposed new claims and amendments to the independent claims to 
further distinguish the claims fi-om the applied references. No final agreement was 
reached. 
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Rejections under 35 U.S.C. § 103 

Claims 1-4, 7-10. 14. 16-19, 24-26. 29-33. and 37-40 

At page 4 of the Office Action, the Examiner rejected claims 1-4, 7-10, 14, 16- 
19, 24-26, 29-33, and 37-40 under 35 U.S.C. § 103(a) as allegedly being unpatentable 
over U.S. Patent Number 6,041,412 to Timson et al ("Timson") in view of U.S. Patent 
Number 6,959,336 to Moreh et al ("Moreh") and further in view of U.S. Patent Number 
6,839,843 to Bacha et al, ("Bacha"). Applicants respectfully traverse this rejection and 
the Response to Arguments on pages 2-4 of the Office Action. 

The system in Timson uses "two secure data modules which contain security data 
and other information" and "a dual module reader for reading data and permissions 
contained on the secure data modules." (Timson, col. 2, lines 14-21.) Timson states that 
"[t]he two secure data modules include an enabling module and an interrogatable 
module." (Timson, col. 2, lines 21-22.) Timson further states that "[t]he interrogatable 
module is either physically inserted into the dual module reader or brought into 
contactless communication with the dual module reader." (Timson, col. 2 line 66- col. 3, 
line 1.) Timson states that "[ijnitially, there is a 'handshake' procedure by which the dual 
module reader determines whether the enabling card and interrogatable card can 
interface or communicate . . . [a]fter the initial handshake is successful, the interrogatable 
module and interrogatable module reader transmits a challenge to the enabling module 
via the enabling module reader to determine whether the enabling module is authorized 
to perform data operations to the data contained on the interrogatable module . . . the 
ability of the enabling module and enabling module reader to perform the requested data 
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operations on the interrogatable module ... is detennined in an isolated manner by the 

set of permissions contained in the enabling module." (Timson, col, 3, lines 11-21.) 

Timson discloses that "[i]f it is determined that the enabUng module does not 
have the appropriate permissions to perform data operations on the interrogatable 
module data, the response from the enabling module is negative and no data 
communication is allowed. In contrasts if the enabling module does have appropriate 
permissions to perform the requested data operations on the interrogatable module data, 
the enabling module and the enabling module reader send a challenge to the 
interrogatable module to determine if the holder of the interrogatable module has 
appropriate authority to conduct the requested data operations on that particular 
interrogatable module." (Timson, col. 3, lines 29-40 (emphasis added).) 

Thus, Timson does not teach "submitting, by the controller, a request for 
authorization . . . in response to a comparison that indicates that access by the access 
candidate is prohibited '' as recited by claim 1 (emphasis added). Rather, Timson 
explicitly states that ''no data communication is allowed" if "the enabling module does 
not have appropriate permissions to perform data operations." 

Further, Moreh teaches that upon successful authentication, the protocol proxy 
receives back from the authentication mechanism a response including attributes and 
access rights of the subject. (Moreh, col. 6, lines 7-19 and col. 2, lines 57-62.) 

Additionally, Timson does not teach "submitting a request for authorization to a 
resolution authority ... in response to a comparison of one or more attributes of the 
access candidate with the one or more access requirements associated with the second 
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security level that indicates that access to the second security level by the access 

candidate is prohibited," as recited by claim 7, "means for submitting a request for 

authorization to a resolution authority ... if the second comparison indicates that access 

to the electronic data by the access candidate is prohibited," as recited by claim 16, 

"submitting, by the controller, a request for authorization to a resolution authority, which 

is configured to modify the one or more access requirements, in response to a 

comparison that indicates that access by the access candidate is prohibited," as recited by 

claim 24, "submitting, by the controller, a request for authorization to a resolution 

authority ... in response to a comparison that indicates that access by the access 

candidate is prohibited," as recited by claim 29, or "submitting a request for 

authorization to a resolution authority in response to a comparison of one or more 

attributes of the access candidate with the one or more access requirements associated 

with the second security level that indicates that access to the second security level by 

the access candidate is prohibited," as recited by claim 30. As noted above with respect 

to claim 1, Timson explicitly states that ''no data communication is allowed" if "the 

enabling module does not have appropriate permissions to perform data operations." 

At pages 5 and 6 of the Office Action, the Examiner states, to which Applicants 
do not acquiesce, that Moreh teaches "a resolution authority" and that Bacha teaches 
"configured to modify the one or more access requirements." However, the Examiner 
does not use Moreh or Bacha to teach, nor do they teach, at least the above-noted 
distinguishing features of claims 1, 7, 16, 24, 29, and 30. Therefore, Moreh and Bacha 
cannot be used to cure the deficiencies of Timson. Thus, the applied references cannot 
be used to establish a prima facie case of obviousness for claims 1,7, 16, 24, 29, and 30. 
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Accordingly, Applicants respectfully request the Examiner to reconsider and 

withdraw the 35 U.S.C. § 103(a) rejection of claims 1, 7, 16, 24, 29, and 30 and to pass 

these claims to allowance. Additionally, at least based on their respective dependencies 

to claims 1, 7, 16, 24, and 30 claims 2-4, 8-10, 14, 17-19, 25, 26, 31-33, and 37-40 

should be found allowable over the applied references, as well as for their additional 

distinguishing features. 

Claims 5, 6, 11-13, 15. 20-23. 27. 28, and 34-36 

At page 15 of the Office Action, the Examiner rejected claims 5, 6, 1 1-13, 15, 20- 
23, 27, 28, and 34-36 under 35 U.S.C. § 103(a) as allegedly being unpatentable over 
Timson in view of Moreh and further in view of Bacha and U.S. Patent Application 
Pubhcation Number 2004/0049687 to Orsini et al ("Orsini"). AppUcants respectfully 
traverse this rejection and the Response to Arguments on pages 2-4 of the Office Action. 

Timson discloses an "interrogatable module" and an "enabling module" that 
"communicate with each other via a dual module reader," (Timson at col, 2, lines 3 1 and 
32.) Timson further discloses that "[t]he interrogatable module and interrogatable 
module reader transmit a challenge to the enabling module via the enabling module 
reader to determine whether the enabling module is authorized to perform data 
operations to the data contained on the interrogatable module." (Timson, col. 3, lines 11- 
16 (emphasis added),) Timson also teaches that "[i]f the enabling module does have 
appropriate permissions to perform the requested data operations on the interrogatable 
module data, the enabling module and the enabling module reader send a challenge to 
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the interrogatable module to determine if the holder of the intrrogatable module has 

appropriate authority to conduct the requested data operations on that particular 

interrogatable module." 

Thus, Timson does not teach "receiving ... a request for access to the first 
security level," as recited by claim 15 or "a resource access controller configured to grant 
access to the one or more resources, in response to a request for access to the one or 
more resources," as recited by claim 23. Rather, Timson discloses that a '' challenge " is 
sent "to the interrogatable module to determine if the holder of the interrogatable 
module has appropriate authority to conduct the requested data operations." 

At pages 15 of the Office Action, the Examiner states, to which Applicants do not 
acquiesce, that Omisi teaches "wherein one or more access requirements are related to at 
least one of a citizenship status of the access candidate or a currently location of the 
access candidate." However, the Examiner does not use Omisi to teach, nor does it 
teach, at least the above-noted distinguishing features of claims 15 and 23. Therefore, 
Omisi cannot be used to cure the deficiencies of Timson, Moreh, and Bacha. Thus, the 
applied references cannot be used to establish a prima facie case of obviousness for 
claims 15 and 23. 

Accordingly, Applicants respectfully request the Examiner to reconsider and 
withdraw the 35 U.S.C. § 103(a) rejection of claims 15 and 23 and to pass these claims 
to allowance. Additionally, at least based on their respective dependencies to claims 1, 
7, 16, 24, and 30, claims 5, 6, 1 1-13, 20-22, 27, 28, and 34-36 should be found allowable 
over the applied references, as well as for their additional distinguishing features. 
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New Claims 41 and 42 

New claim 41 depends from claim 1, and new claim 42 depends from claim 15, 
Thus, for at least this reason, new claims 41 and 42 should be found allowable over the 
applied references. 

Further, new claims 41 and 42 contain additional features that distinguish over 
the applied references. For example, new claim 41 recites, inter alia, "receiving 
supplemental evidence verif3dng the attributes of the access candidate.," and new claim 
42 recites, inter alia, " wherein the data subsets are separated into the at least one data 
class based on a data provider of the data." 



Conclusion 

All of the stated grounds of rejection have been properly traversed, 
accommodated, or rendered moot. Applicants therefore respectfully request that the 
Examiner reconsider all presently outstanding rejections and that they be withdrawn. 
Applicants believe that a full and complete reply has been made to the outstanding 
Office Action and, as such, the present application is in condition for allowance. If the 
Examiner believes, for any reason, that personal communication will expedite 
prosecution of this application, the Examiner is invited to telephone the undersigned at 
the number provided. 
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Prompt and favorable consideration of this Amendment and Reply is respectfully 
requested. 



Date: 
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1 1 00 New York Avenue, N. W. 
Washington, D.C. 20005-3934 
(202) 371-2600 



Respectfully submitted, 

Sterne, Kessler, Goldstein &, Fox p.l.l.c. 
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Attorney for Applicants 
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